ReportWire

Tag: Spyware

  • Here’s the tech powering ICE’s deportation crackdown  | TechCrunch

    [ad_1]

    President Donald Trump said he would make countering immigration one of his flagship policies during his second term in The White House, promising an unprecedented number of deportations. 

    A year in, data shows that deportations by Immigration and Customs Enforcement (ICE) and Customs and Border Protection have surpassed at least 350,000 people. 

    ICE has taken center stage in Trump’s mass removal campaign, raiding homes, workplaces, and public parks in search of undocumented people, prompting widespread protests and resistance from communities across the United States. 

    ICE uses several technologies to identify and surveil individuals. Homeland Security has also used the shadow of Trump’s deportations to challenge long-standing legal norms, including forcibly entering homes to arrest people without a judicial warrant, a move that legal experts say violates the Fourth Amendment protections against unreasonable searches and seizures. 

    Here are some of the technologies that ICE is relying on.

    Cell-site simulators

    ICE has a technology known as cell-site simulators to snoop on cellphones. These surveillance devices, as the name suggests, are designed to appear as a cellphone tower, tricking nearby phones to connect to them. Once that happens, the law enforcement authorities who are using the cell-site simulators can locate and identify the phones in their vicinity, and potentially intercept calls, text messages, and internet traffic.  

    Cell-site simulators are also known as “stingrays,” based on the brand name of one of the earliest versions of the technology, which was made by U.S. defense contractor Harris (now L3Harris); or IMSI catchers, a technology that can capture a nearby cell phone’s unique identifier which law enforcement can use for identifying the phone’s owner.  

    In the last two years, ICE has signed contracts for more than $1.5 million with a company called TechOps Specialty Vehicles (TOSV), which produces customized vans for law enforcement. 

    A contract worth more than $800,000 dated May 8, 2025 said TOSV will provide “Cell Site Simulator (CSS) Vehicles to support the Homeland Security Technical Operations program.”  

    TOSV president Jon Brianas told TechCrunch that the company does not manufacture the cell-site simulators, but rather integrates them “into our overall design of the vehicle.” 

    Cell-site simulators have long been controversial for several reasons.  

    These devices are designed to trick all nearby phones to connect to them, which means that by design they gather the data of many innocent people. Also, authorities have sometimes deployed them without first obtaining a warrant.  

    Authorities have also tried to keep their use of the technology secret in court, withholding information, and even accepting plea deals and dropping cases rather than disclose information about their use of cell-site simulators. In a court case in 2019 in Baltimore, it was revealed that prosecutors were instructed to drop cases rather than violate a non-disclosure agreement with the company that makes the devices.  

    Facial recognition

    Clearview AI is perhaps the most well-known facial-recognition company today. For years, the company promised to be able to identify any face by searching through a large database of photos it had scraped from the internet. 

    On Monday, 404 Media reported that ICE has signed a contract with the company to support its law enforcement arm Homeland Security Investigations (HSI), “with capabilities of identifying victims and offenders in child sexual exploitation cases and assaults against law enforcement officers.” 

    According to a government procurement database, the contract signed last week is worth $3.75 million. 

    ICE has had other contracts with Clearview AI in the last couple of years. In September 2024, the agency purchased “forensic software” from the company, a deal worth $1.1 million. The year before, ICE paid Clearview AI nearly $800,000 for “facial recognition enterprise licenses.”

    Clearview AI did not respond to a request for comment. 

    ICE is also using a facial recognition app called Mobile Fortify, which federal agents use to identify people on the street. The app relies on scanning a person’s driver’s license photo against 200 million photos, much of the data sourced from state driver’s license databases.

    Paragon phone spyware

    Contact Us

    Do you have more information about ICE and the technology it uses? We would love to learn how this affects you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

    In September 2024, ICE signed a contract worth $2 million with Israeli spyware maker Paragon Solutions. Almost immediately, the Biden administration issued a “stop work order,” putting the contract under review to make sure it complied with an executive order on the government’s use of commercial spyware. 

    Because of that order, for nearly a year, the contract remained in limbo. Then, last week, the Trump administration lifted the stop work order, effectively reactivating the contract. 

    At this point, the status of Paragon’s relationship with ICE in practice is unclear.  

    The records entry from last week said that the contract with Paragon is for “a fully configured proprietary solution including license, hardware, warranty, maintenance, and training.” Practically speaking, unless the hardware installation and training were done last year, it may take some time for ICE to have Paragon’s system up and running.

    It’s also unclear if the spyware will be used by ICE or HSI, an agency whose investigations are not limited to immigration, but also cover online child sexual exploitation, human trafficking, financial fraud, and more.

    Paragon has long tried to portray itself as an “ethical” and responsible spyware maker, and now has to decide if it’s ethical to work with Trump’s ICE. A lot has happened to Paragon in the last year. In December, American private equity giant AE Industrial purchased Paragon, with a plan to merge it with cybersecurity company RedLattice, according to Israeli tech news site Calcalist.

    In a sign that the merger may have taken place, when TechCrunch reached out to Paragon for comment on the reactivation of the ICE contract last week, we were referred to RedLattice’s new vice president of marketing and communications Jennifer Iras. 

    RedLattice’s Iras did not respond to a request for comment for this article, nor for last week’s article.

    In the last few months, Paragon has been ensnared in a spyware scandal in Italy, where the government has been accused of spying on journalists and immigration activists. In response, Paragon cut ties with Italy’s intelligence agencies. 

    Phone hacking and unlocking technology

    In mid-September, ICE’s law enforcement arm Homeland Security Investigations signed a contract with Magnet Forensics for $3 million.

    This contract is specifically for software licenses so that HSI agents can “recover digital evidence, process multiple devices,” and “generate forensic reports,” according to the contract description.

    Magnet is the current maker of the phone hacking and unlocking devices known as Graykey. These devices essentially give law enforcement agents the ability to connect a locked phone to them and unlock them and access the data inside of them. 

    Magnet Forensics, which merged with Graykey makers Grayshift in 2023, did not respond to a request for comment.

    Cellphone location data 

    At the end of September, 404 Media reported that ICE bought access to “an “all-in-one” surveillance tool that allows the agency to search through databases of historical cellphone location data, as well as social media information.  

    The tool appears to be made of two products called Tangles and Webloc, which are made by a company called Penlink. One of the tools promises to leverage “a proprietary data platform to compile, process, and validate billions of daily location signals from hundreds of millions of mobile devices, providing both forensic and predictive analytics,” according to a redacted contract found by 404 Media.  

    The redacted contract does not identify which one of the tools makes that promise, but given its description, it’s likely Webloc. Forbes previously cited a case study that said Webloc can search a given location to “monitor trends of mobile devices that have given data at those locations and how often they have been there.”  

    This type of cellphone location data is harvested by companies around the world using software development kits (SDKs) embedded in regular smartphone apps, or with an online advertising process called real-time bidding (RTB) where companies bid in real-time to place an ad on the screen of a cellphone user based on their demographic or location data. The latter process has the by-product of giving ad tech companies that kind of personal data.  

    Once collected, this mass of location data is transferred to a data broker who then sells it to government agencies. Thanks to this layered process, authorities have used this type of data without getting a warrant by simply purchasing access to the data. 

    The other tool, Tangles, is an “AI-powered open-source intelligence” tool that automates “the search and analysis of data from the open, deep, and the dark web,” according to Penlink’s official site.  

    Forbes reported in September that ICE spent $5 million on Penlink’s two tools.  

    Penlink did not respond to a request for comment.  

    License plate readers

    ICE relies on automated license plate reader (ALPR) companies to follow drivers across a large swath of the U.S., such as where people go and when.

    ICE also leans on its connections with local law enforcement agencies, which have contracts with ALPR providers, like surveillance company Flock Safety, to obtain immigration data by the backdoor. Flock is one of the largest ALPR providers, with over 40,000 license plate scanners around the United States, and only getting larger with its partnerships with other companies, such as video surveillance company Ring.

    Efforts by ICE to informally request data from local law enforcement has prompted some police departments to cut off federal agencies from their access.

    Border Patrol runs its own surveillance network of ALPR cameras, the Associated Press reported.

    For years, ICE has used the legal research and public records data broker LexisNexis to support its investigations. 

    In 2022, two non-profits obtained documents via Freedom of Information Act requests, which revealed that ICE performed more than 1.2 million searches over seven months using a tool called Accurint Virtual Crime Center. ICE used the tool to check the background information of migrants.   

    A year later, The Intercept revealed that ICE was using LexisNexis to detect suspicious activity and investigate migrants before they even committed a crime, a program that a critic said enabled “mass surveillance.”

    According to public records, LexisNexis currently provides ICE “with a law enforcement investigative database subscription (LEIDS) which allows access to public records and commercial data to support criminal investigations.” 

    This year, ICE has paid $4.7 million to subscribe to the service. 

    LexisNexis spokesperson Jennifer Richman told TechCrunch that ICE has used the company’s product “data and analytics solutions for decades, across several administrations.”

    “Our commitment is to support the responsible and ethical use of data, in full compliance with laws and regulations, and for the protection of all residents of the United States,” said Richman, who added that LexisNexis “partners with more than 7,500 federal, state, local, tribal, and territorial agencies across the United States to advance public safety and security.” 

    Surveillance giant Palantir

    Data analytics and surveillance technology giant Palantir has signed several contracts with ICE in the last year. The biggest contract, worth $18.5 million from September 2024, is for a database system called “Investigative Case Management,” or ICM.

    The contract for ICM goes back to 2022, when Palantir signed a $95.9 million deal with ICE. The Peter Thiel-founded company’s relationship with ICE dates back to the early 2010s. 

    Earlier this year, 404 Media, which has reported extensively on the technology powering Trump’s deportation efforts, and particularly Palantir’s relationship with ICE, revealed details of how the ICM database works. The tech news site reported that it saw a recent version of the database, which allows ICE to filter people based on their immigration status, physical characteristics, criminal affiliation, location data, and more. 

    According to 404 Media, “a source familiar with the database” said it is made up of ‘tables upon tables’ of data and that it can build reports that show, for example, people who are on a specific type of visa who came into the country at a specific port of entry, who came from a specific country, and who have a specific hair color (or any number of hundreds of data points).” 

    The tool, and Palantir’s relationship with ICE, was controversial enough that sources within the company leaked to 404 Media an internal wiki where Palantir justifies working with Trump’s ICE. 

    Palantir is also developing a tool called “ImmigrationOS,” according to a contract worth $30 million revealed by Business Insider. 

    ImmigrationOS is said to be designed to streamline the “selection and apprehension operations of illegal aliens,” give “near real-time visibility” into self-deportations, and track people overstaying their visa, according to a document first reported on by Wired.

    First published on September 13, 2025 and updated on September 18, 2025 to include Magnet Forensics’ new contract, again on October 8, 2025 to include cell-site simulators and location data, and again on January 26, 2026 to include license plate readers.

    [ad_2]

    Lorenzo Franceschi-Bicchierai, Zack Whittaker

    Source link

  • You’ve been targeted by government spyware. Now what? | TechCrunch

    [ad_1]

    It was a normal day when Jay Gibson got an unexpected notification on his iPhone. “Apple detected a targeted mercenary spyware attack against your iPhone,” the message read.

    Ironically, Gibson used to work at companies that developed exactly the kind of spyware that could trigger such a notification. Still, he was shocked that he received a notification on his own phone. He called his father, turned off and put his phone away, and went to buy a new one.

    “I was panicking,” he told TechCrunch. “It was a mess. It was a huge mess.”  

    Gibson is just one of an ever-increasing number of people who are receiving notifications from companies like Apple, Google, and WhatsApp, all of which send similar warnings about spyware attacks to their users. Tech companies are increasingly proactive in alerting their users when they become targets of government hackers, and in particular those who use spyware made by companies such as Intellexa, NSO Group, and Paragon Solutions.

    But while Apple, Google, and WhatsApp alert, they don’t get involved in what happens next. The tech companies direct their users to people who could help, but at which point the companies step away.

    This is what happens when you receive one of these warnings. 

    Warning 

    You have received a notification that you were the target of government hackers. Now what? 

    First of all, take it seriously. These companies have reams of telemetry data about their users and what happens on both their devices and their online accounts. These tech giants have security teams that have been hunting, studying, and analyzing this type of malicious activity for years. If they think you have been targeted, they are probably right. 

    It’s important to note that in the case of Apple and WhatsApp notifications, receiving one doesn’t mean you were necessarily hacked. It’s possible that the hacking attempt failed, but they can still tell you that someone tried. 

    A photo showing the text of a threat notification sent by Apple to a suspected spyware victim (Image: Omar Marques/Getty Images)

    In the case of Google, it’s most likely that the company blocked the attack, and is telling you so you can go into your account and make sure you have multi-factor authentication on (ideally a physical security key or passkey), and also turn on its Advanced Protection Program, which also requires a security key and adds other layers of security to your Google account. In other words, Google will tell you how to better protect yourself in the future. 

    In the Apple ecosystem, you should turn on Lockdown Mode, which switches on a series of security features that makes it more difficult for hackers to target your Apple devices. Apple has long claimed that it has never seen a successful hack against a user with Lockdown Mode enabled, but no system is perfect. 

    Mohammed Al-Maskati, the director of Access Now’s Digital Security Helpline, a 24/7 global team of security experts who investigate spyware cases against members of civil society, shared with TechCrunch the advice that the helpline gives people who are concerned that they may be targeted with government spyware.

    This advice includes keeping your devices’ operating systems and apps up-to-date; switching on Apple’s Lockdown Mode, and Google’s Advanced Protection for accounts and for Android devices; be careful with suspicious links and attachments; to restart your phone regularly; and to pay attention to changes in how your device functions.

    Contact Us

    Have you received a notification from Apple, Google, or WhatsApp about being targeted with spyware? Or do you have information about spyware makers? We would love to hear from you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.

    Reaching out for help

    What happens next depends on who you are. 

    There are open source and downloadable tools that anyone can use to detect suspected spyware attacks on their devices, which requires a little technical knowledge. You can use the Mobile Verification Toolkit, or MVT, a tool that lets you look for forensic traces of an attack on your own, perhaps as a first step before looking for assistance. 

    If you don’t want or can’t use MVT, you can go straight to someone who can help. If you are a journalist, dissident, academic, or human rights activist, there are a handful of organizations that can help. 

    You can turn to Access Now and its Digital Security Helpline. You can also contact Amnesty International, which has its own team of investigators and ample experience in these cases. Or, you can reach out to The Citizen Lab, a digital rights group at the University of Toronto, which has been investigating spyware abuses for almost 15 years. 

    If you are a journalist, Reporters Without Borders also has a digital security lab that offers to investigate suspected cases of hacking and surveillance. 

    Outside of these categories of people, politicians or business executives, for example, will have to go elsewhere. 

    If you work for a large company or political party, you likely have a competent (hopefully!) security team you can go straight to. They may not have the specific knowledge to investigate in-depth, but in that case they probably know who to turn to, even if Access Now, Amnesty, and Citizen Lab cannot help those outside of civil society. 

    Otherwise, there aren’t many places executives or politicians you can turn to, but we have asked around and found the ones below. We can’t fully vouch for any of these organizations, nor do we endorse them directly, but based on suggestions from people we trust, it’s worth pointing them out. 

    Perhaps the most well known of these private security companies is iVerify, which makes an app for Android and iOS, and also gives users an option to ask for an in-depth forensic investigation. 

    Matt Mitchell, a well-regarded security expert who’s been helping vulnerable populations protect themselves from surveillance has a new startup, called Safety Sync Group, which offers this kind of service. 

    Jessica Hyde, a forensic investigator with experience in the public and private sectors, has her own startup called Hexordia, and offers to investigate suspected hacks. 

    Mobile cybersecurity company Lookout, which has experience analyzing government spyware from around the world, has an online form that allows people to reach out for help to investigate cyberattacks involving malware, device compromise, and more. The company’s threat intelligence and forensics teams may then get involved.  

    Then, there’s Costin Raiu, who heads TLPBLACK, a small team of security researchers who used to work at Kaspersky’s Global Research and Analysis Group, or GReAT. Raiu was the unit’s head when his team discovered sophisticated cyberattacks from elite government hacking teams from the United States, Russia, Iran, and other countries. Raiu told TechCrunch that people who suspect they’ve been hacked can email him directly.

    Investigation

    What happens next depends on who you go to for help. 

    Generally speaking, the organization you reach out to may want to do an initial forensic check by looking at a diagnostic report file that you can create on your device, which you can share with the investigators remotely. At this point, this doesn’t require you to hand over your device to anyone. 

    This first step may be able to detect signs of targeting or even infection. It may also turn out nothing. In both cases, the investigators may want to dig deeper, which will require you to send in a full backup of your device, or even your actual device. At that point, the investigators will do their work, which may take time because modern government spyware attempts to hide and delete its tracks, and will tell you what happened. 

    Unfortunately, modern spyware may not leave any traces. The modus operandi these days, according to Hassan Selmi, who leads the incident response team at Access Now’s Digital Security Helpline, is a “smash and grab” strategy, meaning that once spyware infects the target device, it steals as much data as it can, and then tries to remove any trace and uninstall itself. This is assumed as the spyware makers trying to protect their product and hide its activity from investigators and researchers.  

    If you are a journalist, a dissident, an academic, a human rights activist, the groups who help you may ask if you want to publicize the fact that you were attacked, but you’re not required to do so. They will be happy to help you without taking public credit for it. There may be good reasons to come out, though: To denounce the fact that a government targeted you, which may have the side effect of warning others like you of the dangers of spyware; or to expose a spyware company by showing that their customers are abusing their technology. 

    We hope you never get one of these notifications. But we also hope that, if you do, you find this guide useful. Stay safe out there.

    [ad_2]

    Lorenzo Franceschi-Bicchierai

    Source link

  • Meet the team that hunts government spyware

    [ad_1]

    For more than a decade, dozens of journalists and human rights activists have been targeted and hacked by governments all over the world. Cops and spies in Ethiopia, Greece, Hungary, India, Mexico, Poland, Saudi Arabia, and United Arab Emirates, among others, have used sophisticated spyware to compromise the phones of these victims, who at times have also faced real-world violence being intimidated, harassed, and in extreme cases, even murdered.

    In the last few years, in the fight to protect these higher-risk communities, a team of a dozen digital security experts, mostly based in Costa Rica, Manila, and Tunisia, among other places, have played a key role. They work for the New York-headquartered nonprofit Access Now, specifically its Digital Security Helpline. 

    Their mission is to be the team of people who journalists, human rights defenders, and dissidents can go to if they suspect they’ve been hacked, such as with mercenary spyware made by companies like NSO Group, Intellexa, or Paragon. 

    “The idea is to provide this 24/7 service to civil society and journalists so they can reach out whenever they have… a cybersecurity incident,” Hassen Selmi, who leads the incident response team at the Helpline, told TechCrunch. 

    According to Bill Marczak, a senior researcher at the University of Toronto’s Citizen Lab who has been investigating spyware for almost 15 years, Access Now’s Helpline is a “frontline resource” for journalists and others who may have been targeted or hacked with spyware.

    The helpline has become a critical funnel for victims. So much so that when Apple sends its users a so-called “threat notification” alerting them that they have been targeted with mercenary spyware, the tech giant has long directed victims to Access Now’s investigators. 

    In speaking with TechCrunch, Selmi described a scenario where someone gets one of these threat notifications, and where Access Now can help victims.

    “Having someone who could explain it to them, tell them what they should do, what they should not do, what this means… This is a big relief for them,” said Selmi. 

    According to several digital rights experts who have investigated spyware cases and previously spoke with TechCrunch, Apple is generally taking the right approach, even if the optics look like a trillion-dollar tech giant offloading its responsibility to a small team of nonprofit workers. 

    Being mentioned by Apple in the notifications, said Selmi, was “one of the biggest milestones” for the helpline.

    Selmi and his colleagues now look into about 1,000 cases of suspected government spyware attacks per year. Around half of those cases turn into actual investigations, and only around 5% of them, around 25, result in a confirmed case of spyware infection, according to Mohammed Al-Maskati, the helpline’s director.

    When Selmi started doing this work in 2014, Access Now were only investigating around 20 cases of suspected spyware attacks per month. 

    At the time, there were three or four people working in each timezone in Costa Rica, Manila, and Tunisia, locations that allowed them to have someone online throughout the whole day. The team isn’t that much bigger now, with fewer than 15 people working for the helpline. The helpline has more people in Europe, the Middle East, North Africa, and Sub-Saharan region, given that these are hotspots for spyware cases, according to Selmi.  

    The increase in cases, Selmi explained, is due to several circumstances. For one, the helpline is now more well known, so it attracts more people. Then, with government spyware going global and becoming more available, there are potentially more cases of abuse. Finally, the helpline team has done more outreach to potentially targeted populations, finding cases of abuse they may not have found otherwise. 

    Contact Us

    Have you received a notification from Apple, Google, or WhatsApp about being targeted with spyware? Or do you have information about spyware makers? We would love to hear from you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.

    When someone contacts the helpline, Selmi told TechCrunch, its investigators first acknowledge receipt, then they do a first check to see if the person who contacted them is within the organization’s mandate, meaning if they are part of civil society — and not, for example, a business executive or lawmaker. Then, the investigators assess the case in triage. If a case is prioritized, the investigators ask questions, such as why the person believes they were targeted (if there was no notification), and what device they own, which helps to establish what kind of information the investigators may need to collect from the victim’s device.

    After an initial, limited check of the device performed remotely over the internet, the helpline’s handlers and investigators may ask the victim to send more data, such as a full backup of their device, to do a more thorough analysis examining for signs of intrusions. 

    “For each known kind of exploit that has been used in the last five years, we have a process on how to check that exploit,” said Selmi, referring to known hacking techniques. 

    “We know more or less what is normal, what is not,” said Selmi.

    The Access Now handlers, who manage communication and often speak the victim’s language, will also give the victim advice on what to do, such as whether to get another device, or take other precautions. 

    Every case that the nonprofit looks into is unique. “It’s different from person to person, from culture to culture,” Selmi told TechCrunch. “I think we should do more research, get more people on board — not just technical people — to know how to deal with these kinds of victims.”

    Selmi said that the helpline has also been supporting similar investigative teams in some regions of the world, sharing documentation, knowledge, and tools, as part of a coalition called CiviCERT, a global network of organizations that can help members of civil society who suspect they were targeted with spyware. 

    Selmi said this network has also helped to reach journalists and others in places where otherwise they could not get to. 

    “No matter where they are, [victims] have people who could talk to and report to,” Selmi told TechCrunch. “Having these people talk their language and know their context helped a lot.”

    [ad_2]

    Lorenzo Franceschi-Bicchierai

    Source link

  • As Spyware Companies Get Chummy with White House, Apple and WhatsApp Say They’ll Protect Your Phone

    [ad_1]

    Statements that they’ll help thwart “mercenary spyware” are putting Apple and Meta on the side of platform users with fears about spying tools.

    The Guardian reports that two spyware firms with ties to Israel are seeking to “make inroads with the Trump administration.” Those companies include the NSO Group—the notorious seller of the powerful Pegasus mobile spyware—and a firm called Paragon, which has previously contracted with the government.

    Due to its many, many controversies over the years, NSO has had its fair share of financial problems, but the Israeli firm was recently bought by a U.S.-based group of investors. David Friedman, who previously served as Trump’s ambassador to Israel during his first administration, has been named NSO’s new head executive.

    Recently, Friedman told the Wall Street Journal that he wanted to cozy up to the White House and sell NSO’s services to American law enforcement agencies. “If the administration, as I expect they’ll be, is receptive to considering any opportunity that might keep Americans safer, it will consider us,” Friedman told the newspaper.

    Paragon, meanwhile, is another Israeli spyware firm that was also recently purchased by an American company. Last December, Paragon, maker of a piece of spyware called Graphite, was acquired by a U.S. investment firm called Red Lattice, Reuters previously reported. The Guardian notes that Paragon has worked in the past with the U.S. government, having “entered an agreement with ICE in 2024, under the Biden administration.” The outlet writes: 

    Several people who spoke on the condition of anonymity said the relatively small contract had slipped under the White House’s radar until it was reported by Wired. The contract was then paused in order to determine whether the contract met the requirements of an ambitious executive order that had been signed by the White House in May 2023 and prohibited the operational use of spyware that poses “risks to national security or has been misused by foreign actors to enable human rights abuses around the world.”

    NSO has been accused of letting its products hack into some of the most prominent web messengers and platforms—including Meta’s WhatsApp and Apple’s iMessage. Paragon has also been accused of allowing its tool Graphite to target WhatsApp users. Now, The Guardian reports that both of those companies are pledging that they will protect mobile users from any future spyware.

    A spokesperson from Apple told The Guardian: “Threat notifications are designed to inform and assist users who may have been individually targeted by mercenary spyware and geographic location is not a factor in who they are sent to.” Apple did not respond to Gizmodo’s request for comment.

    When reached for comment by Gizmodo, a Meta spokesperson said: “WhatsApp’s priority is to protect our users by disrupting hacking efforts by mercenary spyware, building new layers of protection and alerting people whose device has come under threat, no matter where they are in the world.”

    Gizmodo reached out to NSO for comment. It was unclear how to reach Paragon Solutions, as its website didn’t appear to have a contact portal. NSO has previously claimed that its products do not target U.S. citizens.

    Authorities in the U.S. have had their eyes on these spyware firms for some time—albeit for different, often contradictory, reasons. On the one hand, in 2021, the Biden administration acknowledged that companies like NSO were having a detrimental impact and blacklisted it from U.S. investment. On the other hand, the FBI also spent years mulling whether to use the spyware for domestic law enforcement investigations. Now, the two powerful cyberweapons distributors seem to be attempting to cozy up to the Trump administration.

    [ad_2]

    Lucas Ropek

    Source link

  • Here’s the tech powering ICE’s deportation crackdown  | TechCrunch

    [ad_1]

    President Donald Trump made countering immigration one of his flagship issues during last year’s presidential campaign, promising an unprecedented number of deportations. 

    In his first eight months in office, that promise turned into around 350,000 deportations, a figure that includes deportations by Immigration and Customs Enforcement, or ICE (around 200,000), Customs and Border Protection (more than 132,000), and almost 18,000 self-deportations, according to CNN.  

    ICE has taken center stage in Trump’s mass deportation campaign, raiding homes, workplaces, and public parks in search of undocumented immigrants. To aid its efforts, ICE has at its disposal several technologies capable of identifying and surveilling individuals and communities.

    Here is a recap of some of the technology that ICE has in its digital arsenal. 

    Clearview AI facial recognition

    Clearview AI is perhaps the most well-known facial-recognition company today. For years, the company promised to be able to identify any face by searching through a large database of photos it had scraped from the internet. 

    On Monday, 404 Media reported that ICE has signed a contract with the company to support its law enforcement arm Homeland Security Investigations (HSI), “with capabilities of identifying victims and offenders in child sexual exploitation cases and assaults against law enforcement officers.” 

    According to a government procurement database, the contract signed last week is worth $3.75 million. 

    ICE has had other contracts with Clearview AI in the last couple of years. In September 2024, the agency purchased “forensic software” from the company, a deal worth $1.1 million. The year before, ICE paid Clearview AI nearly $800,000 for “facial recognition enterprise licenses.”

    Clearview AI did not respond to a request for comment. 

    Paragon phone spyware

    Contact Us

    Do you have more information about ICE and the technology it uses? We would love to learn how this affects you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

    In September 2024, ICE signed a contract worth $2 million with Israeli spyware maker Paragon Solutions. Almost immediately, the Biden administration issued a “stop work order,” putting the contract under review to make sure it complied with an executive order on the government’s use of commercial spyware. 

    Because of that order, for nearly a year, the contract remained in limbo. Then, last week, the Trump administration lifted the stop work order, effectively reactivating the contract. 

    At this point, the status of Paragon’s relationship with ICE in practice is unclear.  

    The records entry from last week said that the contract with Paragon is for “a fully configured proprietary solution including license, hardware, warranty, maintenance, and training.” Practically speaking, unless the hardware installation and training were done last year, it may take some time for ICE to have Paragon’s system up and running.

    It’s also unclear if the spyware will be used by ICE or HSI, an agency whose investigations are not limited to immigration, but also cover online child sexual exploitation, human trafficking, financial fraud, and more.

    Paragon has long tried to portray itself as an “ethical” and responsible spyware maker, and now has to decide if it’s ethical to work with Trump’s ICE. A lot has happened to Paragon in the last year. In December, American private equity giant AE Industrial purchased Paragon, with a plan to merge it with cybersecurity company RedLattice, according to Israeli tech news site Calcalist.

    In a sign that the merger may have taken place, when TechCrunch reached out to Paragon for comment on the reactivation of the ICE contract last week, we were referred to RedLattice’s new vice president of marketing and communications Jennifer Iras. 

    RedLattice’s Iras did not respond to a request for comment for this article, nor for last week’s article.

    In the last few months, Paragon has been ensnared in a spyware scandal in Italy, where the government has been accused of spying on journalists and immigration activists. In response, Paragon cut ties with Italy’s intelligence agencies. 

    Phone hacking and unlocking technology

    In mid-September, ICE’s law enforcement arm Homeland Security Investigations signed a contract with Magnet Forensics for $3 million.

    This contract is specifically for software licenses so that Homeland Security Investigations agents can “recover digital evidence, process multiple devices” and “generate forensic reports,” according to the contract description.

    Magnet is the current maker of the phone hacking and unlocking devices known as Graykey. These devices essentially give law enforcement agents the ability to connect a locked phone to them, and be able to unlock it and access the data inside of them. 

    Magnet Forensics, which merged with Graykey makers Grayshift in 2023, did not respond to a request for comment.

    For years, ICE has used the legal research and public records data broker LexisNexis to support its investigations. 

    In 2022, two non-profits obtained documents via Freedom of Information Act requests, which revealed that ICE performed more than 1.2 million searches over seven months using a tool called Accurint Virtual Crime Center. ICE used the tool to check the background information of migrants.   

    A year later, The Intercept revealed that ICE was using LexisNexis to detect suspicious activity and investigate migrants before they even committed a crime, a program that a critic said enabled “mass surveillance.”

    According to public records, LexisNexis currently provides ICE “with a law enforcement investigative database subscription (LEIDS) which allows access to public records and commercial data to support criminal investigations.” 

    This year, ICE has paid $4.7 million to subscribe to the service. 

    LexisNexis spokesperson Jennifer Richman told TechCrunch that ICE has used the company’s product “data and analytics solutions for decades, across several administrations.”

    “Our commitment is to support the responsible and ethical use of data, in full compliance with laws and regulations, and for the protection of all residents of the United States,” said Richman, who added that LexisNexis “partners with more than 7,500 federal, state, local, tribal, and territorial agencies across the United States to advance public safety and security.” 

    Surveillance giant Palantir

    Data analytics and surveillance technology giant Palantir has signed several contracts with ICE in the last year. The biggest contract, worth $18.5 million from September 2024, is for a database system called “Investigative Case Management,” or ICM.

    The contract for ICM goes back to 2022, when Palantir signed a $95.9 million deal with ICE. The Peter Thiel-founded company’s relationship with ICE dates back to the early 2010s. 

    Earlier this year, 404 Media, which has reported extensively on the technology powering Trump’s deportation efforts, and particularly Palantir’s relationship with ICE, revealed details of how the ICM database works. The tech news site reported that it saw a recent version of the database, which allows ICE to filter people based on their immigration status, physical characteristics, criminal affiliation, location data, and more. 

    According to 404 Media, “a source familiar with the database” said it is made up of ‘tables upon tables’ of data and that it can build reports that show, for example, people who are on a specific type of visa who came into the country at a specific port of entry, who came from a specific country, and who have a specific hair color (or any number of hundreds of data points).” 

    The tool, and Palantir’s relationship with ICE, was controversial enough that sources within the company leaked to 404 Media an internal wiki where Palantir justifies working with Trump’s ICE. 

    Palantir is also developing a tool called “ImmigrationOS,” according to a contract worth $30 million revealed by Business Insider. 

    ImmigrationOS is said to be designed to streamline the “selection and apprehension operations of illegal aliens,” give “near real-time visibility” into self-deportations, and track people overstaying their visa, according to a document first reported on by Wired.

    First published on September 13, and updated on September 18 to include Magnet Forensics’ new contract.

    [ad_2]

    Lorenzo Franceschi-Bicchierai

    Source link

  • Here’s the tech powering ICE’s deportation crackdown  | TechCrunch

    [ad_1]

    President Donald Trump made countering immigration one of his flagship issues during last year’s presidential campaign, promising an unprecedented number of deportations. 

    In his first eight months in office, that promise turned into around 350,000 deportations, a figure that includes deportations by Immigration and Customs Enforcement (around 200,000), Customs and Border Protection (more than 132,000), and almost 18,000 self-deportations, according to CNN.  

    ICE has taken center stage in Trump’s mass deportation campaign, raiding homes, workplaces, and public parks in search of undocumented immigrants. To aid its efforts, the ICE has at its disposal several technologies capable of identifying and surveilling individuals and communities.

    Here is a recap of some of the technology that ICE has in its digital arsenal. 

    Clearview AI facial recognition

    Clearview AI is perhaps the most well-known facial recognition company today. For years, the company promised to be able to identify any face by searching through a large database of photos it had scraped from the internet. 

    On Monday, 404 Media reported that ICE has signed a contract with the company to support its law enforcement arm Homeland Security Investigations (HSI), “with capabilities of identifying victims and offenders in child sexual exploitation cases and assaults against law enforcement officers.” 

    According to a government procurement database, the contract signed last week is worth $3.75 million. 

    ICE has had other contracts with Clearview AI in the last couple of years. In September 2024, the agency purchased “forensic software” from the company, a deal worth $1.1 million. The year before, ICE paid Clearview AI nearly $800,000 for “facial recognition enterprise licenses.”

    Clearview AI did not respond to a request for comment. 

    Contact Us

    Do you have more information about ICE and the technology it uses? We would love to learn how this affects you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

    Paragon phone spyware

    In September 2024, ICE signed a contract worth $2 million with Israeli spyware maker Paragon Solutions. Almost immediately, the Biden administration issued a “stop work order,” putting the contract under review to make sure it complied with an executive order on the government’s use of commercial spyware. 

    Because of that order, for nearly a year, the contract remained in limbo. Then, last week, the Trump administration lifted the stop work order, effectively reactivating the contract. 

    At this point, it’s unclear what’s the status of Paragon’s relationship with ICE in practice. 

    The records entry from last week said that the contract with Parago is for “a fully configured proprietary solution including license, hardware, warranty, maintenance, and training.” Practically speaking, unless the hardware installation and training were done last year, it may take some time for ICE to have Paragon’s system up and running.

    It’s also unclear if the spyware will be used by ICE or HSI, an agency whose investigations are not limited to immigration, but also cover online child sexual exploitation, human trafficking, financial fraud, and more.

    Paragon has long tried to portray itself as an “ethical” and responsible spyware maker, and now has to decide if it’s ethical to work with Trump’s ICE. A lot has happened to Paragon in the last year. In December, American private equity giant AE Industrial purchased Paragon, with a plan to merge it with cybersecurity company Red Lattice, according to Israeli tech news site Calcalist.

    In a sign that the merger may have taken place, when TechCrunch reached out to Paragon for comment on the reactivation of the ICE contract last week, we were referred to RedLattice’s new vice president of marketing and communications Jennifer Iras. 

    RedLattice’s Iras did not respond to a request for comment for this article, nor for last week’s article.

    In the last few months, Paragon has been ensnared in a spyware scandal in Italy, where the government has been accused of spying on journalists and immigration activists. In response, Paragon cut ties with Italy’s intelligence agencies. 

    For years, ICE has used the legal research and public records data broker LexisNexis to support its investigations. 

    In 2022, two non-profits obtained documents via Freedom of Information Act requests, which revealed that ICE performed more than 1.2 million searches over seven months using a tool called Accurint Virtual Crime Center. ICE used the tool to check the background information of migrants.   

    A year later, The Intercept revealed that ICE was using LexisNexis to detect suspicious activity and investigate migrants before they even committed a crime, a program that a critic said enabled “mass surveillance.”

    According to public records, LexisNexis currently provides ICE “with a law enforcement investigative database subscription (LEIDS) which allows access to public records and commercial data to support criminal investigations.” 

    This year, ICE has paid $4.7 million to subscribe to the service. 

    LexisNexis spokesperson Jennifer Richman told TechCrunch that ICE has used the company’s product “data and analytics solutions for decades, across several administrations.”

    “Our commitment is to support the responsible and ethical use of data, in full compliance with laws and regulations, and for the protection of all residents of the United States,” said Richman, who added that LexisNexis “partners with more than 7,500 federal, state, local, tribal, and territorial agencies across the United States to advance public safety and security.” 

    Surveillance giant Palantir

    Data analytics and surveillance technology giant Palantir has signed several contracts with ICE in the last year. The biggest contract, worth $18.5 million from September 2024, is for a database system called “Investigative Case Management,” or ICM.

    The contract for ICM goes back to 2022, when Palantir signed a $95.9 million deal with Palantir. The Peter Thiel-founded company’s relationship with ICE dates back to the early 2010s. 

    Earlier this year, 404 Media, which has reported extensively on the technology powering Trump’s deportation efforts, and particularly Palantir’s relationship with ICE, revealed details of how the ICM database works. The tech news site reported that it saw a recent version of the database, which allows ICE to filter people based on their immigration status, physical characteristics, criminal affiliation, location data, and more. 

    404 Media cited “a source familiar with the database,” who said it is made up of ‘tables upon tables’ of data and that it can build reports that show, for example, people who are on a specific type of visa who came into the country at a specific port of entry, who came from a specific country, and who have a specific hair color (or any number of hundreds of data points).” 

    The tool, and Palantir’s relationship with ICE, was controversial enough that sources within the company leaked to 404 Media an internal wiki where Palantir justifies working with Trump’s ICE. 

    Palantir is also developing a tool called “ImmigrationOS,” according to a contract worth $30 million revealed by Business Insider. 
    ImmigrationOS is said to be designed to streamline the “selection and apprehension operations of illegal aliens,” give “near real-time visibility” into self-deportations, and track people overstaying their visa, according to a document first reported on by Wired.

    [ad_2]

    Lorenzo Franceschi-Bicchierai

    Source link

  • Apple’s latest iPhone security feature just made life more difficult for spyware makers | TechCrunch

    [ad_1]

    Buried in an ocean of flashy novelties announced by Apple this week, the tech giant also revealed new security technology for its latest iPhone 17 and iPhone Air devices. This new security technology was made specifically to fight against surveillance vendors and the types of vulnerabilities they rely on the most, according to Apple.

    The feature is called Memory Integrity Enforcement (MIE) and is designed to help stop memory corruption bugs, which are some of the most common vulnerabilities exploited by spyware developers and makers of phone forensic devices used by law enforcement. 

    “Known mercenary spyware chains used against iOS share a common denominator with those targeting Windows and Android: they exploit memory safety vulnerabilities, which are interchangeable, powerful, and exist throughout the industry,” Apple wrote in its blog post. 

    Cybersecurity experts, including people who make hacking tools and exploits for iPhones, tell TechCrunch that this new security technology could make Apple’s newest iPhones some of the most secure devices on the planet. The result is likely to make life harder for the companies that make spyware and zero-day exploits for planting spyware on a target’s phone or extracting data from them. 

    “The iPhone 17 is probably now the most secure computing environment on the planet that is still connected to the internet,” a security researcher, who has worked on developing and selling zero-days and other cyber capabilities to the U.S. government for years, told TechCrunch.

    The researcher told TechCrunch that MIE will raise the cost and time to develop their exploits for the latest iPhones, and consequently up their prices for paying customers.

    “This is a huge deal,” said the researcher, who asked to remain anonymous to discuss sensitive matters. “It’s not hack proof. But it’s the closest thing we have to hack proof. None of this will ever be 100% perfect. But it raises the stakes the most.”

    Contact Us

    Do you develop spyware or zero-day exploits and are studying studying the potential effects of Apple’s MIE? We would love to learn how this affects you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

    Jiska Classen, a professor and researcher who studies iOS at the Hasso Plattner Institute in Germany, agreed that MIE will raise the cost of developing surveillance technologies.

    Classen said this is because some of the bugs and exploits that spyware companies and researchers have that currently work will stop working once the new iPhones are out and MIE is implemented. 

    “I could also imagine that for a certain time window some mercenary spyware vendors don’t have working exploits for the iPhone 17,” said Classen. 

    “This will make their life arguably infinitely more difficult,” said Patrick Wardle, a researcher who runs a startup that makes cybersecurity products specifically for Apple devices. “Of course that is said with the caveat that it’s always a cat-and-mouse game.”

    Wardle said people who are worried about getting hacked with spyware should upgrade to the new iPhones. 

    The experts TechCrunch spoke to said MIE will reduce the efficacy of both remote hacks, such as those launched with spyware like NSO Group’s Pegasus and Paragon’s Graphite. It will also help to protect against physical device hacks, such as those performed with phone unlocking hardware like Cellebrite or Graykey. 

    Taking on the “majority of exploits”

    Most modern devices, including the majority of iPhones today, run software written in programming languages that are prone to memory-related bugs, often called memory overflow or corruption bugs. When triggered, a memory bug can cause the contents of memory from one app to spill into other areas of a user’s device where it shouldn’t go.

    Memory-related bugs can allow malicious hackers to access and control parts of a device’s memory that they shouldn’t be permitted to. The access can be used to plant malicious code that’s capable of gaining broader access to a person’s data stored in the phone’s memory, and exfiltrating it over the phone’s internet connection.

    MIE aims to defend against these kinds of broad memory attacks by vastly reducing the attack surface in which memory vulnerabilities can be exploited.

    According to Halvar Flake, an expert in offensive cybersecurity, memory corruptions “are the vast majority of exploits.” 

    MIE is built on a technology called Memory Tagging Extension (MTE), originally developed by chipmaker Arm. In its blog post, Apple said over the past five years it worked with Arm to expand and improve the memory safety features into a product called Enhanced Memory Tagging Extension (EMTE).  

    MIE is Apple’s implementation of this new security technology, which takes advantage of Apple having complete control of its technology stack, from software to hardware, unlike many of its phone-making competitors.

    Google offers MTE for some Android devices; the security-focused GrapheneOS, a custom version of Android, also offers MTE. 

    But other experts say Apple’s MIE goes a step further. Flake said the Pixel 8 and GrapheneOS are “almost comparable,” but the new iPhones will be “the most secure mainstream” devices.

    MIE works by allocating each piece of a newer iPhone’s memory with a secret tag, effectively its own unique password. This means only apps with that secret tag can access the physical memory in the future. If the secret doesn’t match, the security protections kick in and block the request, the app will crash, and the event is logged.

    That crash and log is particularly significant since it’s more likely for spyware and zero-days to trigger a crash, making it easier for Apple and security researchers investigating attacks to spot them. 

    “A wrong step would lead to a crash and a potentially recoverable artifact for a defender,” said Matthias Frielingsdorf, the vice president of research at iVerify, a company that makes an app to protect smartphones from spyware. “Attackers already had an incentive to avoid memory corruption.”

    Apple did not respond to a request for comment.

    MIE will be on by default system wide, which means it will protect apps like Safari and iMessage, which can be entry points for spyware. But third-party apps will have to implement MIE on their own to improve protections for their users. Apple released a version of EMTE for developers to do that. 

    In other words, MIE is a huge step in the right direction, but it will take some time to see its impact, depending on how many developers implement it and how many people buy new iPhones. 

    Some attackers will inevitably still find a way.

    “MIE is a good thing and it might even be a big deal. It could significantly raise the cost for attackers and even force some of them out of the market,” said Frielingsdorf. “But there are going to be plenty of bad actors that can still find success and sustain their business.”

    “As long as there are buyers there will be sellers,” said Frielingsdorf.

    [ad_2]

    Lorenzo Franceschi-Bicchierai, Zack Whittaker

    Source link

  • Brussels spyware bombshell: Surveillance software found on officials’ phones

    Brussels spyware bombshell: Surveillance software found on officials’ phones

    [ad_1]

    The European Parliament is on high alert for cyberattacks and foreign interference in the run-up to the EU election in June.

    POLITICO reported in December that an internal review showed that the institution’s cybersecurity “has not yet met industry standards” and is “not fully in-line with the threat level” posed by state-sponsored hackers and other threat groups.

    One member of the security and defense subcommittee went in for a routine check on Tuesday, which resulted in a discovery of traces of spyware on their phone. The member told POLITICO it wasn’t immediately clear why they were targeted with hacking software.

    Parliament’s Deputy Spokesperson Delphine Colard said in a statement that “traces found in two devices” prompted the email calling on members to have their phones checked.

    “In the given geopolitical context and given the nature of the files followed by the subcommittee on security and defence, a special attention is dedicated to the devices of the members of this subcommittee and the staff supporting its work,” the statement said.

    The new revelations follow previous incidents with other European Parliament members targeted with spyware. Researchers revealed in 2022 that the phones of members of the Catalan independence movement, including EU politicians, were infected with Pegasus and Candiru, two types of hacking tools. That same year, Greek member of the EU Parliament and opposition leader Nikos Androulakis was among a list of Greek political and public figures found to have been targeted with Predator, another spyware tool. Parliament’s President Roberta Metsola previously also faced an attempted hacking using spyware.

    European Parliament members in 2022 set up a special inquiry committee to investigate the issue. It investigated a series of scandals in countries including Spain, Greece, Hungary and Poland and said at least four governments in the EU had abused the hacking tools for political gain.

    Parliament’s IT service launched a system to check members’ phones for spyware in April last year. It had run “hundreds of operations” since the program started, the statement said.

    [ad_2]

    Antoaneta Roussi

    Source link

  • Government hackers targeted iPhones owners with zero-days, Google says | TechCrunch

    Government hackers targeted iPhones owners with zero-days, Google says | TechCrunch

    [ad_1]

    Government hackers last year exploited three unknown vulnerabilities in Apple’s iPhone operating system to target victims with spyware developed by a European startup, according to Google.

    On Tuesday, Google’s Threat Analysis Group, the company’s team that investigates nation-backed hacking, published a report analyzing several government campaigns conducted with hacking tools developed by several spyware and exploit sellers, including Barcelona-based startup Variston.

    In one of the campaigns, according to Google, government hackers took advantage of three iPhone “zero-days,” which are vulnerabilities not known to Apple at the time they were exploited. In this case, the hacking tools were developed by Variston, a surveillance and hacking technology startup whose malware has already been analyzed twice by Google in 2022 and 2023.

    Contact Us

    Do you have more information about Variston or Protect Electronic Systems? We’d love to hear from you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email lorenzo@techcrunch.com. You also can contact TechCrunch via SecureDrop.

    Google said it discovered the unknown Variston customer using these zero-days in March 2023 to target iPhones in Indonesia. The hackers delivered an SMS text message containing a malicious link that infected the target’s phone with spyware, and then redirected the victim to a news article by the Indonesian newspaper Pikiran Rakyat. Google did not say who was Variston’s government customer in this case.

    An Apple spokesperson did not comment to TechCrunch, asking whether the company is aware of this hacking campaign found by Google.

    While Variston keeps getting attention from Google, the company has lost multiple employees over the past year, according to former staff who spoke to TechCrunch on the condition of anonymity because they were under a non-disclosure agreement.

    It is not yet known who Variston sold its spyware to. According to Google, Variston collaborates “with several other organizations to develop and deliver spyware.”

    Google says one of the organizations was Protected AE, which is based in the United Arab Emirates. Local business records identify the company as “Protect Electronic Systems,” and say it was founded in 2016 and headquartered in Abu Dhabi. On its official website, Protect bills itself as “a cutting edge cyber security and forensic company.”

    According to Google, Protect “combines spyware it develops with the Heliconia framework and infrastructure, into a full package which is then offered for sale to either a local broker or directly to a government customer,” referring to Variston’s software Heliconia, which Google previously detailed in 2022.

    Variston was founded in 2018 in Barcelona by Ralf Wegener and Ramanan Jayaraman, and shortly after acquired Italian zero-day research company Truel IT, according to Spanish and Italian business records seen by TechCrunch.

    Wegener and Jayaraman did not respond to a request for comment by email. Representatives from Protect also did not respond.

    While there has been a lot of attention in the last few years on Israeli companies like NSO Group, Candiru, and QuaDream, Google’s report shows that European spyware makers are expanding their reach and capabilities.

    Google wrote in its report that its researchers track around 40 spyware makers, which sell exploits and surveillance software to government customers around the world. In the report Google mentions not only Variston, but also the Italian companies Cy4Gate, RCS Lab, and Negg as examples of relatively newer companies that have entered the market. RCS Lab was founded in 1993 and used to be a partner of the now-defunct spyware maker Hacking Team, but didn’t develop spyware on its own until recent years, focusing instead on selling products to conduct traditional phone wiretapping at the telecom providers’ level.

    In its report, Google said it is committed to disrupting hacking campaigns conducted with these companies’ tools because they have been linked to targeted surveillance of journalists, dissidents, and politicians.

    “Commercial surveillance vendors (CSVs) are enabling the proliferation of dangerous hacking tools,” Google wrote in its report. “The harm is not hypothetical. Spyware vendors point to their tools’ legitimate use in law enforcement and counterterrorism. However, spyware deployed against journalists, human rights defenders, dissidents, and opposition party politicians — what Google refers to as ‘high risk users’ — has been well documented.”

    “While the number of users targeted by spyware is small compared to other types of cyber threat activity, the follow-on effects are much broader,” the company wrote. “This type of focused targeting threatens freedom of speech, a free press, and the integrity of elections worldwide.”

    [ad_2]

    Lorenzo Franceschi-Bicchierai

    Source link

  • How to find hidden cameras in hotels and house rentals: We tested five ways — and one's the clear winner

    How to find hidden cameras in hotels and house rentals: We tested five ways — and one's the clear winner

    [ad_1]

    Hidden cameras are being found in hotel rooms, house rentals, cruise ships, and even airplane bathrooms, leaving many travelers to wonder:

    “Could a hidden camera be watching me?”

    Spycams, as they’re called, are getting smaller, harder to find and easier to buy.

    From alarm clocks to air fresheners, water bottles and toothbrush holders, cameras come embedded in common household items that seamlessly blend with home decor. They can be purchased in shops or online, and through retailers like Amazon and Walmart.

    And rather than having to retrieve the camera to obtain the recording, owners can stream live images straight to their phones, said Pieter Tjia, CEO of the Singapore-based tech services company OMG Solutions.

    Even worse, voyeurs can sell the footage to porn sites, where it can be viewed thousands of times.

    It’s no wonder why websites, from YouTube to TikTok, are filled with videos of people recommending simple ways to find hidden cameras.

    But do they these suggestions work?

    To find out, Tjia and his team hid 27 cameras in a home, and then provided CNBC with commonly recommended devices to find them.

    In total, CNBC conducted five rounds of tests to see which method was the most effective.

    Test 1: Using the ‘naked eye’

    First, we examined the rooms using the easiest and cheapest method of all: the “naked eye” test.

    My colleague, Victor Loh, went from room to room, noting that nothing seemed out of place or suspicious. After 20 minutes of searching, he found one camera embedded inside a working clock — tipped off because the time was wrong.

    “I found one,” he said. “But it’s so well camouflaged.”

    Cost: $0 | Cameras found: 1

    Test 2: Using a mobile phone

    For this round, Victor downloaded a popular app called Fing, which scans Wi-Fi networks for cameras. He also used his phone’s flashlight to make it easier to see camera lenses, a common online recommendation.

    The app showed 22 devices were connected to the home’s Wi-Fi — but no cameras.

    Tjia explained that when members of his team set up the cameras in the house, they also set up a second wireless network. They then connected the hidden cameras to that network, bypassing the home’s main network.

    “Even if we didn’t do this, the app would show cameras are in the house, but not where they are located,” he said.

    Victor had better luck using his phone’s flashlight. With it, he found three more cameras — in a Wi-Fi repeater, a shirt button and a teddy bear — the last one, like the clock, catching his eye because of something amiss.

    “It’s not grammatically correct,” he said of the bear’s T-shirt, before finding a camera behind one of its eyes.

    Tjia said most hidden cameras are made in China, where, ironically, they are banned.  

    Cost: $25/year for app subscription | Cameras found: 3

    Test 3: Using a radio frequency detector

    With only four of 27 cameras located, it was time to turn to handheld devices designed to find hidden cameras — like a radio frequency detector which beeps when it’s close to a spycam.

    Those work when cameras are turned on and connected to Wi-Fi, which means they won’t find cameras that use SD cards to store data, said Tjia.

    They are also prone to false alarms, he added, as we watched Victor search the rooms, for the third time, through a barrage of piercing beeps.

    The device also had a built-in lens detector, but the beeping proved so distracting that Victor didn’t locate a single camera with this device. It even beeped when he was in parts of the house that had no cameras at all, said Tjia.

    Cost: $100-$200 | Cameras found: 0

    Test 4: Using a lens detector

    Next up: a basic lens detector, which is cheap, portable and easy to use. The device emits infrared light, which reflects back from a camera lens as a red dot.

    The problem? You must be close to the camera for it to work.

    Lens detectors are a popular way to locate spycams, but CNBC only found two cameras with this one.

    CNBC

    Despite its popularity online, Victor found only two cameras with this device — one in an essential oil diffuser, and the other in a Wi-Fi mesh device.

    Cost: $50 | Cameras found: 2

    Test 5: Using an advanced lens detector

    For the final test, Victor used a more sophisticated lens detector.

    Resembling binoculars, it also accentuates light that is reflected from a camera lens. However, this device works from a distance, allowing Victor to see cameras from across the room. It also works in brightly-lit or dark rooms, said Tjia.

    “Oh wow,” said Victor, as he located cameras — in a tissue box and leather bag, with another buried between files under a desk. But he noted he needed to look straight into the lens to see it. “The angle matters.”

    In total, he found 11 cameras with this device — more than all the other cameras found in the other test rounds, combined.

    Cost: $400 | Cameras found: 11

    The final outcome

    In total, Victor found 17 out of 27 cameras — not a bad result, but not a great one either, especially given the time he spent locating them.

    “When you are traveling, you are really exhausted,” he said. “The last thing you want to do is spend … one hour scrutinizing every nook and cranny just to locate a camera.”

    Social media posts about hidden cameras have increased nearly 400% in the past two years, according to the data company Sprout Social — with countless articles dedicated to finding a quick and easy solution to the growing problem.

    But in this cat-and-mouse game, the cameras have the upper hand, said Tjia.

    The detecting devices are getting better, but so are the cameras being hidden, he said.

    [ad_2]

    Source link

  • US to adopt new restrictions on using commercial spyware | Long Island Business News

    US to adopt new restrictions on using commercial spyware | Long Island Business News

    [ad_1]

    The U.S. government will restrict its use of commercial spyware tools that have been used to surveil human rights activists, journalists and dissidents around the world, under an executive order issued Monday by President Joe Biden.

    The order responds to growing U.S. and global concerns about programs that can capture text messages and other cellphone data. Some programs — so-called “zero-click” exploits — can infect a phone without the user clicking on a malicious link.

    Governments around the world — including the U.S. — are known to collect large amounts of data for intelligence and law enforcement purposes, including communications from their own citizens. The proliferation of commercial spyware has made powerful tools newly available to smaller countries, but also created what researchers and human-rights activists warn are opportunities for abuse and repression.

    The White House released the executive order in advance of its second summit for democracy this week. The order “demonstrates the United States’ leadership in, and commitment to, advancing technology for democracy, including by countering the misuse of commercial spyware and other surveillance technology,” the White House said in a statement.

    Biden’s order, billed as a prohibition on using commercial spyware “that poses risks to national security,” allows for some exceptions.

    The order will require the head of any U.S. agency using commercial programs to certify that the program doesn’t pose a significant counterintelligence or other security risk, a senior administration official said.

    Among the factors that will be used to determine the level of security risk is if a foreign actor has used the program to monitor U.S. citizens without legal authorization or surveil human rights activists and other dissidents.

    “It is intended to be a high bar but also includes remedial steps that can be taken … in which a company may argue that their tool has not been misused,” said the official, who briefed reporters on condition of anonymity under White House ground rules.

    The White House will not publish a list of banned programs as part of the executive order, the official said.

    John Scott-Railton, a researcher at the University of Toronto’s Citizen Lab who has long studied spyware, credited the Biden administration for trying to set new global standards for the industry.

    “Most spyware companies see selling to the U.S. as their eventual exit path,” Scott-Railton said. “The issue is the U.S. until now hasn’t really wielded its purchasing power to push the industry to do better.”

    Congress last year required U.S. intelligence agencies to investigate foreign use of spyware and gave the Office of the Director of National Intelligence the power to ban any agency from using commercial programs.

    Rep. Jim Himes of Connecticut, the top Democrat on the House Intelligence Committee, said in a committee hearing last year that commercial spyware posed a “very serious threat to our democracy and to democracies around the world.” He said Monday the new order should be followed by other democracies taking steps against spyware.

    “It’s a very powerful statement and a good tool, but alone it won’t do the trick,” he said.

    Perhaps the best known example of spyware, the Pegasus software from Israel’s NSO Group, was used to target more than 1,000 people across 50 countries, according to security researchers and a July 2021 global media investigation, citing a list of more than 50,000 cellphone numbers. The U.S. has already placed export limits on NSO Group, restricting the company’s access to U.S. components and technology.

    Officials would not say if U.S. law enforcement and intelligence agencies currently use any commercial spyware. The FBI last year confirmed it had purchased NSO Group’s Pegasus tool “for product testing and evaluation only,” and not for operational purposes or to support any investigation.

    White House officials said Monday they believe 50 devices used by U.S. government employees, across 10 countries, had been compromised or targeted by commercial spyware.

    Despite NSO’s assertions that the program is supposed to be used to counter terrorism and crime, researchers found the numbers of more than 180 journalists, 600 politicians and government officials, and 85 human rights activists.

    Pegasus use was most commonly linked to Mexico and countries in the Middle East. Amnesty International has alleged Pegasus was installed on the phone of Jamal Khashoggi’s fiancée just four days before the journalist was killed in the Saudi consulate in Istanbul in 2018. NSO has denied the allegation that its software was used in connection with Khashoggi’s murder.

    The family of Paul Rusesabagina, credited with saving more than 1,200 lives during the Rwandan genocide, a story depicted in the movie “Hotel Rwanda,” has also alleged it was targeted by spyware. Rusesabagina was lured back to Rwanda under false pretenses and jailed on terrorism charges before his release last week. Rwanda has denied using commercial spyware.

    –

    [ad_2]

    The Associated Press

    Source link

  • New Bedford fire lieutenant uses himself as human shield against flames

    New Bedford fire lieutenant uses himself as human shield against flames

    [ad_1]

    Fire Lt. uses himself as shield against flames

    [ad_2]

    Source link